What happened
The Register's PWNED column reported on a practice that a former Air Force IT security specialist says he watched in the early 2000s. Justin Henkel, now chief information security officer at SolarWinds, described pilots moving mission planning data between unclassified and classified systems on the same piece of removable media.
Before USB drives were common, crews burned mission data to a CD, ran the rest of the planning on a classified system, and then took the same disc to the aircraft, where it supplied navigation and threat information. When thumb drives replaced discs, the habit did not change. "They didn't really think about the overall impact of classified versus unclassified systems," Henkel said. "Using the same device for both, they didn't understand that you could read and write onto a USB drive with malware."
The hardware itself came from the local market. Henkel said personnel bought flash drives from local vendors rather than official military contractors, and that in Afghanistan they were bought from shops in Kabul. He described making relationships with vendors to order drives in bulk, because bringing a US based computer into the country was harder than buying locally. Adversaries noticed, and according to his account began selling infected USB drives to local vendors in the Middle East.
Henkel raised the risk and was ignored. "I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they're doing is a violation," he said. In 2008 the Department of Defense was infected after someone attached a malware carrying USB drive to a laptop with access to US Central Command. The worm, Agent.BTZ, could collect information from infected computers and communicate with remote servers. A 2016 FBI and DHS report attributed it to one or more Russian groups, and it took the Pentagon 14 months to clear. The department banned USB drives in 2008 and allowed them again under certain circumstances in 2010.
Why this is a GRC story
Portable media is a boundary control. The line between classified and unclassified systems holds only if the transfer mechanism is controlled. One device used on both sides of the line collapses it.
Procurement was part of the failure. Buying storage from informal local suppliers removed any assurance about what was preloaded on the devices. Supply chain assumptions apply to the smallest items in an environment, not just the obvious ones.
A rule without authority or awareness does not hold. The policy existed, and a junior specialist identified the violation. Nothing changed until an incident forced it. Escalation routes that actually work, awareness aimed at senior staff, and technical enforcement of removable media policy are what convert a written rule into a control.
What to watch
Removable media remains a live risk anywhere networks are segmented or air gapped, including operational technology and industrial environments where the same convenience argument still applies. Watch for updated guidance on approved media and scanning stations. The more useful exercise is closer to home: if someone needed to move files across a boundary tomorrow, would policy give them a supported route, or would they improvise one and tell nobody?
Attribution: Analysis based on The Register and related public reporting. This article is original commentary, not a repost of the source material.